SiteGround Returns 404 for /.well-known/ — Royal MCP OAuth Fix

Symptoms

You’re hitting this specific issue if all of the following are true:

How to Confirm It’s the nginx /.well-known/ Intercept

Three quick curl tests will leave no doubt about the diagnosis. Run them from any terminal — replace YOUR-DOMAIN.com with your actual domain.

curl -I https://YOUR-DOMAIN.com/.well-known/oauth-authorization-server

curl -I https://YOUR-DOMAIN.com/.well-known/security.txt
curl -I https://YOUR-DOMAIN.com/.well-known/anything-random

curl -s https://YOUR-DOMAIN.com/this-does-not-exist/ | head -20

The Fix — Two Static Files in Your Webroot

You’ll create two text files in public_html/.well-known/ with no file extension. nginx will serve them directly, Claude.ai will read the OAuth metadata it needs, and the authorization handshake will complete normally.

{
  "issuer": "https://YOUR-DOMAIN.com",
  "authorization_endpoint": "https://YOUR-DOMAIN.com/authorize",
  "token_endpoint": "https://YOUR-DOMAIN.com/token",
  "registration_endpoint": "https://YOUR-DOMAIN.com/register",
  "response_types_supported": ["code"],
  "grant_types_supported": ["authorization_code", "refresh_token"],
  "token_endpoint_auth_methods_supported": ["none", "client_secret_post"],
  "code_challenge_methods_supported": ["S256"],
  "scopes_supported": ["mcp:full"],
  "service_documentation": "https://royalplugins.com/support/royal-mcp/"
}

{
  "resource": "https://YOUR-DOMAIN.com/wp-json/royal-mcp/v1",
  "authorization_servers": ["https://YOUR-DOMAIN.com"],
  "bearer_methods_supported": ["header"],
  "scopes_supported": ["mcp:full"]
}

curl -i https://YOUR-DOMAIN.com/.well-known/oauth-authorization-server
curl -i https://YOUR-DOMAIN.com/.well-known/oauth-protected-resource

Why Does SiteGround Block /.well-known/?

The /.well-known/ URL prefix is reserved by RFC 5785 for “well-known” URIs that need a predictable, host-level location — things like ACME SSL certificate challenges (/.well-known/acme-challenge/), security.txt, and OAuth 2.0 / OpenID Connect discovery metadata (RFC 8414).

SiteGround’s nginx layer is configured to serve /.well-known/acme-challenge/* directly so their automated Let’s Encrypt renewals can complete without going through WordPress (which might redirect, return a wrong content type, or be slow). To keep that mechanism reliable, nginx claims the entire /.well-known/ path prefix at the host level: it serves files that physically exist there, and returns a 404 for anything that doesn’t — without falling through to PHP.

That’s great for ACME, but it means RFC 8414 OAuth discovery URLs (which Claude.ai and every other MCP client are required to probe) never reach WordPress. The Royal MCP rewrite rule that maps /.well-known/oauth-authorization-server to a WordPress query var works on every other host we’ve tested — just not on SiteGround, because nginx never lets the request get that far.

What Royal MCP 1.4.14 Already Does for You

Royal MCP 1.4.14 (shipped May 2026) detects this exact failure mode automatically. When the plugin loads on a site where /.well-known/oauth-authorization-server isn’t reachable, it surfaces a dismissible admin notice on the Plugins screen and Royal MCP settings linking back to this page. So future SiteGround customers will land here from inside their own WordPress admin instead of having to search for “Royal MCP couldn’t reach OAuth” first.

The plugin can’t auto-create the static files for you, though — SiteGround’s nginx layer that blocks /.well-known/ reads from the same WordPress installation, so files written via PHP would be served the same way. The static-file step still has to be done manually via File Manager / SFTP.

Faster Alternative for Claude Desktop: Skip OAuth Entirely

If your only goal is to get Claude Desktop connected, the static-file workaround above is more work than you need. You can bypass OAuth completely by passing a Royal MCP API key as a header through mcp-remote, the bridge Claude Desktop uses to talk to remote MCP servers. No /.well-known/, no consent screen, no SiteGround support ticket.

Quick version — full step-by-step at Connect Claude Desktop via API Key:

1. Copy your API key from WP Admin → Royal MCP → Settings
2. Add this entry to your claude_desktop_config.json (substitute your domain and key):

   {
     "mcpServers": {
       "my-site": {
         "command": "npx",
         "args": [
           "-y",
           "mcp-remote",
           "https://YOUR-SITE.com/wp-json/royal-mcp/v1/mcp",
           "--header",
           "X-Royal-MCP-API-Key: YOUR_API_KEY_HERE"
         ]
       }
     }
   }

3. Quit and relaunch Claude Desktop.

This works regardless of whether the /.well-known/ files are in place. It also works regardless of Content-Type, WAF rules, or any other front-end web server quirk — the only thing it needs is the /wp-json/royal-mcp/v1/mcp endpoint reachable, which your curl test in the verification step above already confirmed.

Still Stuck After Creating the Files?

If you’ve verified both files return HTTP/2 200 via curl but Claude.ai still fails, contact support@royalplugins.com with:

We respond within one business day and have resolved this on every SiteGround site we’ve seen so far.